This invention relates generally to an apparatus and method for metering the total amount of time or events a device has experienced during its lifetime, and more particularly for implementing them in failsafe manner using a non-volatile memory that supports a limited number of writes.
Meters that measure usage are useful for gauging the aging of a device or equipment in question. With the logging of the amount of usage, the device could be scheduled for maintenance or replacement in order to maximize reliability and longevity over its useful life.
For electrical or electronic devices, these meters assume the form of a xe2x80x9cpower-onxe2x80x9d meter. Either time or some predefined events are logged while the device is powered on. For example, it is useful for an integrated circuit chip to be able to provide to the user the number of accumulated hours it has been powered on throughout its lifetime. This number must persist through power cycles and must be stored in a non-volatile memory that retains its data even if the power is turned off.
Typically, the non-volatile memory is an EEPROM or a flash EEPROM, which can be electrically writable and erasable by altering the charges stored in the floating gate of each memory cell. However, such a memory has a limited lifetime due to the endurance-related stress it suffers each time it goes through an erase/program cycle. The endurance refers to the memory""s tolerance for a given number of erase/program cycles. Whenever electrons are moved in or out of the floating gate during program or erase, some get trapped in the surrounding dielectric layers. The trapped electrons modify the field effect of the memory transistor. In commercially available EEPROMs, the errors due to electron trappings become so severe that some memory becomes unreliable after undergoing 104 to 106 erase/program cycles.
Another problem in implementing a power-on meter with a non-volatile memory has to do with the reliability and robustness of the data being saved. The program or erase operation of an EEPROM requires a finite amount of time to complete. These operations could be interrupted when power is turned off or interrupted suddenly, resulting in corrupted or incomplete data being saved to the memory. The power interruptions could be caused by the user or by unexpected power failure or power surges in the supply.
A number of prior art solutions have been implemented to address the endurance and robustness problems when storing the data into a non-volatile memory such as EEPROM.
U.S. Pat. No. 4,617,639 discloses an hour meter for an industrial vehicle in which a non-volatile memory is used to store data reflecting elapsed time. Bit changes in the non-volatile memory are minimized by utilizing a gray coded binary representation of a portion of the data and by systematically altering the addressed memory location of a portion of the data in response to one of the stored data values. A 32-bit word is partitioned into groups of 4, 4, 8, 8, 8 bits, respectively for representing a multiple of 1000-hour, of 100-hour, of 10-hour, of 1-hour and of {fraction (1/16)}-hour time intervals. To minimize the number of writes to the non-volatile memory, the last three 8-bit groups are stored as 8-bit gray codes. The gray code has the advantage of changing state only twice during a complete counting cycle from zero through 15 and back to zero again. Furthermore, the 1-hour and the {fraction (1/16)}-hour gray codes are also stored in a different location with each incremental change in the 10-hour time interval. In this way, the number of writes to any memory location is minimized. As for robustness, in the event the battery is disconnected, a capacitor bank in the device provides sufficient residual power to allow the data to be saved back into the non-volatile memory.
U.S. Pat. No. 4,584,647 discloses an electronic postage meter implemented as a ring counter in a non-volatile memory. The ring counter is incremented sequentially at each count and a specific location in the memory is erased and then written with the next number in the sequence. The counter is then stepped to a successive location where the cycle is repeated. In this way all locations suffer about the same number of writes. The ring counter is advantageous in that the redundancy of the numbers stored in the locations of the ring counter makes it relatively easy to determine the exact value stored in the counter. Even in the worst-case failure, it is still possible to reconstruct the counter reading to a value within a few counts of the actual.
U.S. Pat. No. 4,710,888 discloses an electronic odometer in which the sequential odometer values are stored in eight cyclic locations of a non-volatile memory. Each time the vehicle is turned on, data from all the cyclic locations are read and validated by their parity. Then the most recently stored and validated data value is determined and used for display and subsequent measured distance accumulation.
U.S. Pat. No. 5,892,735 discloses a power-on apparatus for an electronic device such as a video CRT display. To ensure robustness of the accumulated data in the event of a power surge or failure or electric shock, three redundant copies of the data are sequentially stored in a non-volatile memory. Each time the apparatus is turned on, the correct value is determined by selecting one that is most closely repeated in the majority of the three copies. If there is an odd one among the three copies, it can be corrected with the value of the majority.
The various prior art solutions described above deal with the robustness problem by one of three ways. In the first way, a small reservoir of power allows the data to be saved into the non-volatile memory in the event of a power failure. However, this method cannot recover from a corruption due to power surge or a defect location in the non-volatile memory. In the second way, a limited history of past saves is maintained in the non-volatile memory. If the last save is corrupted one can always go back to an earlier, albeit less accurate version. In the third way, three copies of each data are saved each time to provide redundancy. However, this method is slow and wasteful and still is not failsafe in the event of power surges.
According to one aspect of the invention, a fail-safe memory backup scheme is implemented so that data is always preserved under any power interruption situation. A data word representing a count of power-on durations or events is incremented count by count during the power-on of a device. After each increment, the data word is backed up to a non-volatile memory that is able to retain its memory even after power is turned off. When power is restored to the device after an interruption, the backed up data word is retrieved from the non-volatile memory to continue the increment process. To forestall the data becoming corrupted due to power interruption in the middle of a backup, the invention calls for a two-version redundancy scheme in which at least one valid version of the data word always exists in the non-volatile memory.
Essentially, two versions of the data word and its associated error correction code (xe2x80x9cECCxe2x80x9d) are maintained in the non-volatile memory. When retrieving the data word from the non-volatile memory, the two versions are checked for validity against their associated ECCs. There are two possibilities: one is when both versions are valid and the other is when one version is valid and one version is corrupted. Generally, a valid version with the largest count is selected for restoration. In other words, if both versions are valid, the one that carries the higher count will be selected. If only one version is valid, it will be selected. When the incremented data word is backed up to the non-volatile memory, it will replace the version there that was not last selected. In this way, even if the back up proves unsuccessful it will not overwrite a valid version. Thus, there will always be a valid version of the data word preserved in the non-volatile memory.
According to another aspect of the invention, a robust power-on meter is implemented with a limited write memory by a partitioned memory configuration and operation with respect to the data word and its error correction code. As described earlier, non-volatile memories such as low cost flash EEPROM typically have an endurance of about 10000 writes per memory location. If the data word is backed up to the non-volatile memory after each count increment, the total count will be limited by the endurance limit of the given non-volatile memory. The present scheme allows a robust power-on meter to be implemented where the total number of counts far exceeds the endurance limit of the non-volatile memory.
Essentially, the data word used to represent a given range of counts is partitioned into a least significant (xe2x80x9cLSxe2x80x9d) subword and a most significant (xe2x80x9cMSxe2x80x9d) subword. The LS subword is such that a full cycling of all its bit combinations will not exceed the endurance limit of the non-volatile memory. In this way, a full cycle of counts as represented by the LS subword will be able to be stored in a same memory location count by count. The MS subword is such that a full cycling of all its bit combinations is able to be stored in a same memory location without exceeding the endurance limit of the non-volatile memory. In this way, a full cycle of most significant counts will not exceed the endurance limit of the non-volatile memory. The invention furthers calls for storing the associated ECC in the same manner as, and in correspondence with, the LS subword, since every increment in the data word requires a backup and therefore an associated ECC. Furthermore, every new cycle of the LS subword and the corresponding ECC will be stored in a different memory location. The different memory location has an address dependent on the value of the MS subword. In this way, every time a bit changes in the MS subword, the next cycling of the LS subword and the corresponding ECC are stored in a different location in the non-volatile memory. Thus, the non-volatile memory is able to store a range of counts whose maximum number far exceeds the endurance limit.
In the preferred embodiment, the power-on meter and method support two versions of the LS subword, two versions of the MS subword and two versions of the associated ECC.
Additional features and advantages of the present invention will be understood from the following description of its preferred embodiments, which description should be taken in conjunction with the accompanying drawings.